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(57) Abstract: A portable data carrier comprises a memory with a biometric template which is intended to be compared with a 
biometric sample for identity check. The biometric template is divided into a private part which is adapted to be exclusively used in 
the portable data carrier and a public part which is adapted to be transferred to and used in an external processing unit. Moreover, 
a processing unit, for use in biometric identity check is described. The processing .unit is adapted to receive a biometric sample 
and a public part of a biometric template, compare the received public part of the template with the biometric sample, and when a 
comparison criterion has been satisfied, transfer at least pari of the biometric sample to the portable data carrier for further comparison 
in pie data carrier with a private part of the template. A method for recording a biometric template and a biometric identity check is 
also described. 
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B I OMETRIC IDENTITY CHECK 



Related Applications 

This application claims priority from Swedish Patent 
Application No. SE 0001576-8 and US Provisional Patent 
Application No. 60/210,635. 
5 Field of the Invention 

The present invention relates to a portable data 
carrier which comprises a memory with a biometric tem- 
plate which is intended to be compared with a biometric 
sample for identity check. The invention further relates 
10 to a processing unit, a computer program product and 

various metbods which are intended for use in connection 
with biometric checking of identity. 
Background of the Invent ion 

The access to information, to a room or the like 
15 most in isaxxy cases be restricted to certain individuals. 
This is case, for instance , when electronic money 

transactions occur via the Internet, when in a hospital 
• the access to case records is to be limited, or when only 
certain individuals in a place of work are allowed to 
20 have access to certain information or certain rooms. 

To this end, use is often made of what is referred 
to as intelligent cards or smart cards. A smart card can 
be described as a card in the size of an account card 
which has a built-in processor, a memory and some kind 
25 of communication interface, which in its simplest form 
may consist of one or more metal contacts. 

Also so-called hardware tokens work essentially 
according to the same principle as smart cards . They 
are typically used in a computer as a key to "unlock" 
3 0 the computer and give a user access to information. The 
difference compared with a smart card is more of a prac- 
tical type since a hardware token can be directly insert- 
ed into the USB or serial port of a computer while a 
smart card must be placed in a special smart cart reader 
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which is connected to or incorporated in the computer .- 
For this reason, also the software on the hardware token 
differs somewhat from the software on smart cards, but 
their purpose is essentially the same. 
5 On all smart cards that are used in the above con- 

texts, sensitive information is stored in the memory. 
A first part of the sensitive information is reference 
information stored in advance about the user of the card. 
It is with this reference information that a comparison 
10 is made every time the card user wishes to verify his 
right to use the card. 

Smar t cards also contain a second part of sensitive 
information which consists of c omp uter files which only 
the card user may access. They may contain, for exaaple, 
15 cc w niw i rt er files with, private encryption keys. Icoger pass- 
word* or o ther inf onnatiou that can be used to identify 
the user. When the card user wants to verify that he T^ f 
the right to access to the sensitive itif ornwhinn stored 
in the compu ter files on the smart card, he places the 
20 card in a smar t card reader and enters a pin code <PIK * 
Personal Identification Number) . The pin code is limited 
to 16 bytes and usually consists of four digits between 
zero and nine which are matched with a reference pin code 
stored on the card- If the pin code corresponds with the 
25 reference, "the card is unlocked", i.e. the user gains 
access to the computer files containing the sensitive 
information. Pin codes are presently used in many situa- 
tions, and many people find it difficult to remember a 
number of different pin codes. Therefore, many people 
3 0 choose to use the same pin code in a number of different 
situations, thus deteriorating security. 

For this reason, and with a view to further 
increasing security, alternative solutions have been 
presented, in which a user instead identifies himself 
3 5 with the aid of biometric information. By biometric 

information is meant information which is body-related 
and individual-specific for the user. It may consist of, 
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for instance, the pattern of the user's fingers, palm, 
iris, or some other information which is not -related 
to appearance but yet individual -speci f ic , such as the 
user's voice. A method in which a user identifies himself 
5 with the aid of his fingerprint typically proceeds as 
follows: 

The user places his smart card in a smart card 
reader and one finger on a sensor which generates a 
digital image, i.e. a digital representation, of the 

10 fingerprint. The digital image of the fingerprint pro- 
ceeds to an external processor, for instance a personal 
computer, where it is preprocessed. In the preprocess- 
ing^ ^K#» ^^- m i- i t of information in the image is reduced 
BO tlsat, for instance, a binarised image or parts of a 

15 binarised image are generated- A corresponding prep re- 
cessed Image been stored on the card as reference 
information. This reference information is usually refer- 
red to as a template. The external processor collects the 
template from the card and compares this with the prepro- 

20 cessed image of the finger. In case of correspondence-, 

the external processor transmits a pin code to the card. 
This pin cod** acts as a key and gives access to the sen- 
sitive information stored in the memory of the card. If 
the template and the preprocessed image information do 

25 not correspond with each other, no pin code is transmit- 
ted and the user cannot access the computer files with 
the sensitive information on the card. 

Even if biometry is used so that the user will not 
need to use a pin code, a pin code is still transmitted 

3 0 at the last stage of the verification process since this 
pin code is necessary for the "unlocking" of specific 
files containing sensitive information on the smart card. 
Thus the pin code must be hardcoded either in the soft- 
ware for the application which communicates with the 

3 5 card, or in some hardware in the unit where the card is 
read and written. Consequently no significant increase 
of. the security is achieved despite the use of biometry 
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since there is still a risk that someone may access the 
computer files with sensitive information on -the card by 
transmitting the pin code to the card. 

A further problem is that the template with which 
5 the matching occurs must be read from the card into the 
external processor in which the comparison with the 
user's biometric data takes place. In the first place 
this is a security risk, and in the second place there 
are directives issued by computer security authorities 

10 in certain countries which recommend that a biometric 
template should never leave the smart card. 

One solution to the above problems is presented in 
Swedish Patent No. 8101707-1 which discloses an account 
card type data carrier which is provided with verifi- 

15 cation equipment comprising a sensor on which a user 

places one of his fingers. The sensor records papillary 
line information from the user's finger and calculates 
an identification bit sequence which is compared with 
a previously stored reference bit sequence. If the bit 

20 sequences conform with each other, an acceptance signal 
is generated, which can activate an indication means or 
a connecting meanB which makes the data carrier useable. 

Although this solution eliminates the use of pin 
codes and lets the template remain on the card all the 

25 time, certain drawbacks still remain. For instance, the 
card cannot be a standard type smart card since such a 
card has no sensor and also does not have sufficient 
processor capacity to carry out the proposed method. 
Summary of the Invention 

30 An object of the present invention therefore is to 

obviate, or at least alleviate, the above problems and to 
provide an alternative solution for biometric checking of 
identity, which solution has a high degree of security 
but yet allows use of e.g. a standard type smart card 

35 with limited processing capacity. 

According to the invention, this object is achieved 
by a portable data carrier according to claim 1, a method 
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for biometric checking of identity according to claim 15, 
a computer program product according to claim 22, a pro- 
cessing unit according to claim 24, a method for produc- 
ing a biometric template according to claim 28, a compu- 
5 ter program product according to claim 35, a method for 
biometric checking of identity according to claim 36, a 
computer product according to claim 41 and use of a bio- 
metric template according to claim 42. 

More specifically, the invention concerns a portable 
10 data carrier, comprising a memory with a biometric tem- 
. plate which is intended to be compared with a biometric 
sample fox identity check. The biometric template is 
divided into a private part which is adapted to be exclu- 
sively used in the portable data carrier and a public 
15 part which is adapted to be transferred to an external 
processing unit and be used in the same. 

By portable data carrier is meant a number of dif- 
ferent portable units, such as smart cards, hardware 
tokens, Multi-Media Cards (MMC) etc, which all have the 
20 feature in common that they have a safe memory area which 
can. toe used .for biometric checking of identity, i.e. Tor 
checking that a biometric termplate and a later recorded 
biometric sample originate from the same person-. 

By the, expressions biometric template and biometric 
25 sample are meant data- that is unique to an individual . 

Examples of such data can be the pattern of the person's 
fingers, palm, iris, or the person's voice. The teimplate 
relates to reference information which is stored on the 
data carrier, whereas the sample relates to biometric 
30 data which must be presented by a person on each occasion 
of checking his or hers identity. 

The fact that the template is divided into a private 
and a public part means that a certain part of the tem- 
plate never leaves the data carrier and that this part 
3 5 is thus not accessible to an unauthorised person, which 

results in significantly increased security compared with 
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the case where the entire template is read from the data 
carrier and compared with a sample in an external unit . 

The public part, however, is intended to be trans- 
ferred to the external processing unit and to be used 
only in the same. This makes it possible to carry out 
some processor-demanding processing in the external pro- 
cessing unit so that less processing capacity in the data 
carrier is required, thus making it possible to use, for 
example, standard type smart cards. 

Moreover a possibility of utilising different secu- 
rity levels for different applications is created since 
it is possible either to merely make a first comparison 
between the public part of the template and the biometric 
sample in the external processing unit or, in addition, 
to make a comparison in the data carrier between the pri- 
vate part of the template and the biometric sample. 

This means that first a check of the biometric 
sample is made in the processing unit, and if this check 
satisfies a predetermined comparison criterion, one or 
more parts of the biometric sample are transferred to the 
data carrier for a final check in the same. By the final 
identity check being made on the data carrier, no pin 
code need be generated in the processing unit and trans- 
ferred to the data carrier. Instead one or more parts of 
the biometric sample are transferred, which is much more 
difficult to fake since it is much more complex than a 
common pin code. Security also increases still more since 
it is impossible for an ill-intentioned person to steel 
or copy the entire template from the processing unit 
since only part thereof leaves the data carrier to be 
used in the first comparison in the processing unit . 

According to a preferred embodiment, the private 
part of the biometric template comprises at least one 
partial area, which constitutes a private partial area, 
of a digital image of an individual -specif ic parameter. 
Preferably a plurality of private partial areas are used. 
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Thus the private partial area is a subset of a digi- 
tal image . The use of a partial area of an image in a 
biometric template is advantageous since a suitably 
selected partial area contains much information which 
5 can be used in the identity check. One or more suitably 
selected partial areas, e.g. fingerprint partial areas 
with special line formations, may result in almost the 
same good security as if a complete image of the indivi- 
dual-specific parameter is used while at the same time 

10 the amount of information used in the comparison has been 
reduced to a considerable extent. It goes without saying 
that more partial areaB result in greater security, but 
on the other hand greater processing capacity of the data 
carrier is necessary. 

15 The digital image can be made by means of thermal 

technique, optical technique, capacitive technique or 
some other convenient technique. It may be processed 
after the actual recording, for instance binarised. 

The individual -specific parameter can be, for exam- 

20 pie/ the pattern of a person's iris or retina, a . hand- 
print of some other individual -specific parameter which 
can be reproduced. However, it is preferably a finger- 
print. This enables a simple recording process where 
conventional sensors can be used and the individual can 

25 easily provide the biometric template. 

In a preferred embodiment, the public part of the 
biometric template comprises information which is intend- 
ed to be used for determining a reference point in the 
biometric sample, which reference point corresponds to 

30 a reference point in the biometric template. 

As a result, it is possible to determine how the 
biometric sample is translated in relation to the bio- 
metric sample, which makes it possible to select areas 
of the biometric sample which correspond to the private 

35 partial area or areas. 

In a preferred .embodiment, the public part of the 
biometric template comprises information which is intend- 
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ed to be used for determining how the template is orient- 
ed in relation to the biometric sample. 

It is an advantage to use the public part of the 
template for this purpose since, if one knows how the 
template is oriented in relation to the biometric sample, 
the comparison between, the biometric sample and the pri- 
vate partial area in the data carrier requires less pro- 
cessor capacity as the comparison then need not take 
place for different turning positions. Moreover, a refe- 
rence point is obtained for selecting the areas of the 
biometric sample that are to be sent to the data carrier 
for comparison with the private partial area or areas. 

In a preferred embodiment, the public part of the 
biometric template comprises at least one partial area, 
which constitutes a public partial area, of the digital 
image of the individual -specific parameter . 

In the same way as the private partial area, the 
public partial area thus is a subset of a digital image 
which represents, for instance, a f irtgerprint , the 
pattern of a person' s iris or retina., a handprint or some 
other reproducible individual - specific parameter. The 
public partial area, which preferably is a single partial 
area in the centre of the fingerprint, makes it possible 
to determine the orientation of the template in relation 
to the sample as well as a reference point for selection 
of sample partial areas to be sent to the data carrier 
based on merely a comparison between the partial area and 
the sample in different relative positions. Such a match 
produces a reliable result. 

In a preferred embodiment of the portable data car- 
rier, the number of private partial areas is greater than 
the number of public partial areas in the template. As a 
result , only one or a few areas need be transferred from 
the data carrier to the external processing unit. The. 
comparison with the biometric sample in the external pro- 
cessing unit will therefore be quicker and at the same 
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time security increases still more since a large part of 
the template never leaves the data carrier. 

For instance, there may be a single public partial 
area which is collected from the centre of a fingerprint 
5 and a plurality, for instance four to eight, private par- 
tial areas which are placed in predetermined positions at 
a distance from the public partial area. 

In an alternative embodiment, at least one private 
partial area is located in immediate connection with a 

10 public partial area in the biometric template. This makes 
it easy to determine which partial areas of the biometric 
sample are to be transferred to the data carrier after 
the comparison of the public partial area or areas with 
the sample in f>*» processing unit. Moreover, this partial 

15 area of the biometric sanqple will have been affected in 
the suae m»tin»r (for exoxsple, the ^Ift t a nr r between the 
lines in a fingerprint varies with the force used by the 
individual when applying his finger to the sensor) as the 
partial area r»H was compared with the public part of 

20 the template , results in qui cker and safer identi- 

fication. 

i As an alternative to a partial area, the public part 

of the biometric template may contain information abou t 
the mutual positioning of a plurality of features of 
25 a predetermined type in the digital image of the indivi- 
dual-specific parameter. These features can be, for exam- 
ple, line ends and line branches. The mutual positioning 
thereof can be used to determine the orientation of the 
template relative to the sample by matching the features 

3 0 in the public part of the template with the features in 
the sample. Preferably the public part of the template 
comprises at least five such features. The type of fea- 
tures may, but need not, be included in the public part 
of the template. Furthermore the features can be used to 

35 determine a reference point, which can correspond to, for 
example , a predetermined of the features . 
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The private partial area or areas of the template 
can be placed in the same fashion in relation to the 
public partial area for all templates. Alternatively, 
the private partial area or areas can be selected indi- 
5 vidually for each template so as to contain as much 

information of interest as possible. In the latter case, 
the public part of the biometric template further con- 
tains information about how the private partial area or 
areas are placed in relation to the reference point. 

10 The information can then be used to select in the 

external processing unit which partial areas of the 
sample are to be sent to the data carrier for comparison 
with the private partial area or areas. The information 
can be available in the form of coordinates which axe 

15 related to the . reference point, for instance the centre 
in a public partial area. 

In a preferred embodiment, the portable data carrier 
further comprises at least one threshold value which 
indicates to which extent the private partial area should 

20 correspond to a corresponding partial area of the bio- 
metric sample for these two partial areas to be con- 
sidered to originate from the same individual . By the 
threshold value being stored" in the data carrier, it may- 
be set at different levels in different data carriers, so 

25 that the security requirements can be adjusted to diffe- 
rent situations. The threshold value can even be set 
individual - specif i cally. 

In a preferred embodiment the threshold value is 
stored in the private part of the template. 

3 0 The portable data carrier suitably comprises a com- 

munication means via which the public part of the bio- 
metric template is adapted to be transferred to the 
external processing unit. The communication means can be 
intended for wireless communication, for instance induc- 

35 tive transmission or transmission by means of radio sig- 
nals. However, it is currently preferred for the data 
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carrier to have one or more contacts for galvanic contact 
with the external processing unit. 

The portable data carrier further suitably comprises 
a signal processing means which is adapted to carry out a 
5 comparison between the private part of the template and 
at least part of the biometric sample. The signal pro- 
cessing means may comprise a suitably programmed pro- 
cessor or specifically adapted hardware, such as an ASIC 
(Application Specific Integrated Circuit) or an FPGA 

10 (Field Programmable Gate Array) . 

The portable data carrier is preferably a smart 
card. These cards can be of different standard types, 
such as Java or MULTOS cards, which are simple and inex- 
pensive types of data carrier which can easily be adapted 

15 to different applications and which are easy for a user 
to carry. A standard type smart card which contains data 
about a certain user can thus be used in a plurality of 
situations since it is precisely standardised and since 
the operating system on the card handles the files in 

20 such manner that the handling of the files is independent 
of the application in which the card is used. 

According to a second aspect, the invention relates 
to a metbpd for biometric checking of identity in a pro- 
cessing unit. The method is characterised by the steps 

23 of receiving a biometric sample and a public part of a 
biometric template, which has- a private part stored in 
a second unit and adapted to be used exclusively in the 
second unit, comparing the received public part of the 
template with the biometric sample and, when a compari- 

3 0 son criterion has been satisfied, transferring at least 
part of the biometric sample to the second unit for fur- 
ther comparison with the private part of the biometric 
template. 



35 discussion regarding the data carrier. The second unit 
can be a portable data carrier. It can also be a sta- 
tionary unit, with which the processing unit communi- 



The advantages of the method are evident from the 
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cates. The method is especially usable when the process- 
ing unit has poor security for carrying out the biometric 
checking of identity and when the second unit has limited 
processor capacity and/or when, for various reasons, it 
is desirable to limit the quantity of data to be trans- 
ferred from the processing unit to the second unit. 

The method can be implemented as a computer program 
which is executed by a processor in the processing unit. 
To this end, the invention concerns according to a third 
aspect a computer program product comprising program code 
which, during execution in a computer, carries out a 
method according to claims 15-22. 

According to a fourth aspect, the present invention 
relates to a processing unit for use in biometric check- 
ing of identity, said processing unit comprising means 
for carrying out a method according to claims 15-22. 

The means may comprise a processor with suitable 
software. It may alternatively comprise specially adapted 
hardware. The processing unit can be a suitably program- 
med general computer with means, fox* instance a card 
reader, which permit exchange of information with a 
second unit. It can also be a special card reader which 
has been provided with hardware and/or software which, 
enables carrying out the above -described method direct 
in the card reader- The above means suitably also com- 
prise a communication means for communication with the 
second unit. 

The comparison criterion used in the processing unit 
to determine whether parts of the biometric sample are to 
be sent to the data carrier may vary between different 
applications, depending on which security level is desir- 
able. The criterion can easily be entered in the process- 
ing unit' by a person skilled in the art who is respons- 
ible for the current security system, or it can be stored 
in the software. 

In a preferred embodiment, the processing unit fur- 
ther comprises a sensor for recording the biometric 
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sample. That means that no extra equipment need be con- 
nected to the processing unit and the recording and the 
preprocessing, if any, can thus be integrated so that the 
procedure as from the recording of the user's biometric 
5 sample up to and including the transfer to the portable 
data carrier will be quick. Also security increases since 
the biometric sample need not be transferred between a 
special recording unit and the processing unit. Alterna- 
tively, the sensor can be located in a separate unit, 

10 from which the recorded biometric sample is transferred 
to the processing unit. 

According to a fifth aspect, the invention relates 
to a method of producing a biometric template, compris- 
ing the steps of recording a biometric sample which 

15 represents an individual -specific parameter; selecting 

a first part of the biometric sample? selecting a second 
part of biometric sample; storing the selected first and 
second parts in a memory in a first unit in a public and 
a private part, respectively, of a biometric template, 

20 the private part "being adapted to be used exclusively in 
the first unit and the public part being adapted to be 
used outside the first unit. 

The first unit can be ^ portable data carrier, espe- 
cially a smart card. 

25 When producing the template , a recording of a bio- 

metric sample "thus is made according to a prior- art 
method, in which the result is, for instance, a digital 
image of the current biometric sample. In this sample, 
a private and a public part are then selected. The selec- 

3 0 tion of the first and the second part means that the 

quantity of data that need be stored in the data, carrier 
decreases to a considerable extent, and the advantages 
arising in consequence of this have been discussed above. 
After the parts have been selected, they are transferred 

35 to the data carrier and stored permanently in the memory 
thereof . 
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According to a preferred embodiment of the above 
method, the selection of the first and the second part 
each comprises selection of at least one partial area 
of a digital image, each partial area being selected 
5 according to a predetermined public and/ respectively, 
private selection criterion. 

The selection criterion can vary according to how 
safe the identification is to be made. For example, the 
public and, respectively, the private partial areas can 

10 either be selected in the same way for all individuals, 
or be selected in a unique way to each individual, where 
the areas which are of greatest interest from the view- 
point of identification are selected. However, the public 
partial area or areas are advantageously selected in such 

15 manner that they will be easy to find in the comparison 
with the biometric sample. Consequently, a quick match 
can be carried out in the processing unit. The private 
partial areas, however, can be selected according to 
other criteria since their position in the biometric 

2 0 sample can be related to the position of the public 

partial area and a quick match can therefore still be 
achieved . 

The method can be accomplished in specially adapt- 
ed hardware or software or in a convenient combination 
25 thereof. 

To that end, the invention concerns, according to 
a fifth aspect, a computer program product comprising 
program code which, during execution in a computer, car- 
ries out a method according to claims 28-34. 

3 0 According to a sixth aspect, the invention also 

relates to a method for carrying out biometric checking 
of identity, comprising the steps of recording a bio- 
metric sample which represents an individual- specif ic= 
parameter; comparing in a first unit a public part of a 
35 biometric template, which public part has been received 

from a second unit, with the biometric sample to find, out 
whether a first predetermined comparison criterion has 
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been satisfied; selecting, if the first comparison cri- 
terion has been satisfied, at least part of the biometric 
sample according to a predetermined selection criterion 
and transferring said at least part to a second unit; 
5 comparing in the second unit said at least part of. the 
biometric sample with a private part, stored in the 
second unit, of the biometric template to find out 
whether a second predetermined comparison criterion has 
been satisfied. 

10 The advantages of this method will be evident from 

the discussion above. The first predetermined comparison 
criterion can be a predetermined degree of correspondence 
between the public part and the biometric sample, for 
instance a certain number of matching features or a cer-. 

15 tain number of matching pixels in two overlapping partial 
areas. The second comparison criterion can be a predeter- 
mined degree of correspondence between the private part, 
of the template and part of the biometric sample. This 
comparison criterion can advantageously be stored in the 

2 0 second, unit, and preferably in the private part of the 
template so as not to. be accessible from outside. 

The method can be accomplished in specially adapted 
hardware, in software or in a suitable combination there- 
of. To this end, the invention relates according to a 

2 5 seventh aspect to computer software comprising program 

code which, during execution in a computer, carries out 
a method according to claims 36-40 . 

According to an eighth aspect, the present invention 
relates to use of a biometric template which is divided 

3 0 into, a private part adapted to be exclusively used, in a 

unit in which the template is stored, and a public part 
adapted to be transferred to and used in an external pro- 
cessing unit. 

As an example of use, storing in electronic form of 
35 such a template can be mentioned. 
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^^Description of the Drawings 

^— Mention will now be described m more detail 

by way of an embodiment with reference to the accompany- 

ing schematic drawings. 

Fi o 1 is a schematic drawing illustrating a port- 
able data carrier and a processing unit according to the 

invention. . , ^ 

Fig 2 is a block diagram illustrating a method 
according to the invention of producing a biometric tem- 
plate with a private and a public part and storing thxs 
in a portable data carrier. 

Fig 3 is a block diagram illustrating a method 
according to the invention of performing a biometric 

identity check. 

Figs 4a and b show two different positionings of 
private and public partial areas of a biometric sample 
Lr storage in the form of a template in a portable data 
carrier . 

n^crintion Preferred Embodiments 

£ ^ a achemat . c view ^ system according to 

the invention, which consists of a portable data carrier 
X in the form of a smart card and a processing 
The system is intended to be used for biometric identity 
check based- on fingerprints. 

The smart card 1 is an ordinary standard type card, 
for instance a War MOI.TOS card, and has a -~ ca " 
tion means 3 which is adapted to communicate with the 
processing unit 2. The communication means 3 may comprise 
Le or more metal contacts which make it possible for the 
, processing unit to read information on the smart card 

Le communication means 3 can alternatively comprise cir- 
cuits which enable wireless communication between the 
smart card and the processing unit, e.g. circuits for 
inductive transmission of information or for radio com- 
5 munication. The smart card 1 further has a processor 5 
Id a memory 6. The memory 6 contains sensitive informa- 
tion on the one hand in the form of computer files to 
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which the person using the system wishes to gain access 
and, on the other hand, in the form of a biometric tem- 
plate which has a private part that never leaves the 
smart card and a public part that is allowed to leave the 
5 smart card. In addition to the sensitive information and 
the template, the memory 6 also comprises software which 
the processor 5 uses, for example, to compare the tem- 
plate with a biometric sample. 

The processing unit 2 can be a device which is spe- 
10 cially designed to carry out biometric identity check or 
a standard type computer which has been provided with 
suitable software and a card reader which can read the 
information on the smart card 1. The computer comprises 
a processor 7, which is used in the preprocessing of the 
15 user's biometric sample and in the comparison between 

this and the public part of the template. The processing 
unit further comprises a sensor 8 for recording a finger- 
print. The sensor can be integrated with the processing 
unit or be connected thereto as a separate unit . The 
20 sensor is preferably of a capacitive type but it can also 
be, for instance, optical, thermal or pressure- sensitive . 
The sensor 8 is connected to the processor 7. The pro- 
cessing unit 2 further comprises a communication means 4 
which makes it possible for the processing unit to read 
25 information on the smart card 1. The communication means 
may comprise one or more metal contacts which produce 
galvanic contact with one or more metal contacts on the 
smart card or circuits for inductive transmission of 
information or for transmission by means of radio sig- 
30 nals. The processing unit 2 also comprises a memory 10 

in which software is stored for the preprocessing of the 
biometric sample which the processor 7 carries out. The 
memory 10 also comprises software which, for example, 
controls how the comparison between the preprocessed bio- 
3 5 metric sample and the public part of the biometric sample 
is to be carried out, which comparison criteria are to be 
used, and which part or parts of the biometric sample are 
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to be transferred from the computer 2 to the smart card 
1. The processing unit 2 also has circuits 11 for exter- 
nal communication with other units , such as additional 
sensors or information -carrying units. The communicat ion 
between the different units in the computer 2 and on the 
smart card 1, respectively, occurs via a data bus (not 
shown) . 

Fig. 2 is a block diagram of a method of producing 
a biometric template with a private and a public part . It 
is here assumed that the method is carried out by means 
of a system according to Fig. 1. First, in step 20, a 
digital image in grey scale of the user's fingerprint is 
recorded by means of the sensor 8. This image thus con- 
stitutes a digital representation of the fingerprint. 
The recorded image is checked so that it is ensured, 
for instance, that there is really a fingerprint in the 
image, that the fingerprint takes up a sufficiently large 
part of the image and that the fingerprint is sufficient- 
ly clear. 

It is checked, among other things, whether the user 
has applied his finger with sufficient pressure on the 
sensor 8 and so that any moisture on the user's finger 
has not made it impossible for the sensor 8 to distin- 
guish between "ridges" and ^valleys" on the finger. If 
necessary, the step of recording is repeated. 

When a digital image in grey scale of sufficient 
quality has been recorded by the sensor 8, a binarisa- 
tion of the image occurs . The binarisation implies that 
the pixels of the image are compared with a grey scale 
threshold value. The pixels which have a value smaller 
than the grey scale threshold value are converted to 
white and those having a value greater than the grey 
scale threshold value are converted to black. The grey 
scale threshold value can be the same for the entire 
image or vary between different parts of the image. The 
binarisation algorithm can also be refined, so that the 
pixels are compared with the surroundings, so as to pre- 
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vent, for example, individual pixels from being white 
if all the surrounding pixels are black. Additional pre- 
processing of the image can also be carried out, such as 
change of resolution and contrast improvement. 
5 After binarisation, a partial area, below referred 

to as public partial area, of the image is selected in 
step 21 to be stored in a public part of a template. The 
area can be selected in different ways. One way is to use 
the following three quality criteria: 1) Distinctness, 

10 i.e. how easy a partial area is to binarise, 2) Unique- 
ness, i.e. how unique a partial area is, and 3) Geogra- 
phic location, i.e. where a partial area iB located in 
the fingerprint . 

For instance the uniqueness can be checked by cor- 

15 relating the partial area with the surroundings and 

selecting a partial area with a small degree of correla- 
tion with the surroundings. Alternatively, it is possible 
to search out partial areas with features, i.e. points 
where a fingerprint line branches off or ends . 

20 As regards the geographic location, partial areas 

in the centre of the image are preferred since then there 
is a minimum risk that the partial areas are not included 
in a later recorded sample. Moreover, the image of the 
fingerprint will be least deformed in the centre when the 

25 user applies his finger with different pressures on the 
sensor . 

The partial area which best corresponds to the above 
quality criteria is selected to constitute the public 
partial area. Preferably, a single public partial area 

3 0 in the centre of the image is selected so that as little 
information as possible about the user's fingerprint is 
available in the public part of the template. However, 
a plurality of public partial areas can be selected to 
achieve safer matching of the public part of the template 

3 5 with the biometric sample and thus obtain safer orienta- 
tion of the template in relation to the sample. 
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When the public partial area has been selected, at 
least one, but preferably a plurality of partial areas, 
below referred to as private partial areas, are selected, 
in step 22, for storage in a private part of the template 
on the smart card 1. The private partial areas are pre- 
ferably selected according to the same quality criteria 
as the public partial area or areas. Preferably, six pri- 
vate partial areas are selected. More or fewer partial 
areas can be selected according to the desired security 
level, the desired quickness in matching and the avail- 
able processor capacity on the smart card. 

Pigs 4a and 4b show examples of how public and 
private partial areas can be located in an image of a 
fingerprint. In Fig. 4a, there is a single public partial 
area A located in the centre and nine private partial 
areas B-J. In Fig. 4b there are seven public partial 
areas 101, 201, 301, 701 and the same number of pri- 

vate partial areas 102, 202, 302, 702. In this case, 
the private partial areas are selected so as to be posi- 
tioned ±n immediate connection with the respective public 
partial areas: - - 

The size of the selected public and private partial 
areas is in this embodiment 48 x 48 pixels, but can 
easily be adjusted by a person skilled in the art accord- 
ing to the current requirements. 

In connection with the selecting of the private par- 
tial areas, also their location in relation to a refe- 
rence point is determined. The reference point can be 
selected, for instance, to be the centre in the public 
partial area or in one of these if there are more. Other 
well-defined reference points, for instance by means of 
features, can of course also be selected. The locations 
of the private partial areas are indicated as coordinates 
in relation to the reference point. The coordinates are 
stored as part of the public part of the template. 

Before the template is transferred to the smart card 
1, a test matching is made with an additional image of 
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the user's fingerprint made by means of the sensor 8. The 
test matching is carried out according to the method that 
will be described below with reference to Fig. 3. If the 
additional image and the template match each other, the 
5 template is considered to be recordable. 

In step 23, the public and the private part of the 
template are then transferred from the processing unit 2 
via the communication circuits 3, 4 to the memory 6 of 
the smart card 1. The public part of the template will 

10 thus contain the public partial area or areas as well as 
coordinates for the location of the private partial areas 
in relation to. a reference point. Its private part will 
contain the private partial areas. In the private part, 
it is also possible to store comparison criteria in the 

15 form of threshold values for which degree of matching is 
to be achieved, when matching of the private partial 
areas with sample partial areas, for the template and the 
sample to be considered to originate from the same 
individual . For example, the threshold values may 

20 comprise a first threshold value which indicates to what 
extent an individual private partial area is to match a 
corresponding partial area in the biometric sample. This 
first threshold value may apply to all the private 
partial areas. The threshold values may further comprise 

25 a second threshold value which indicates how many of the 
private partial areas must satisfy the first threshold 
value. They may also comprise a third threshold value for 
the extent to which the private partial areas are to 
match the corresponding sample partial areas. The 

30 threshold values may, but need not, apply to the public 
partial area. 

The partial areas are preferably stored in the form 
of compressed bit maps. 

When the template has been transferred, additional 

35 sensitive information can, if desired, be transferred 
from the computer 2 and stored in the memory 6 of the 
smart card 1. The recording of a template for the card 
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holder is usually made only once. The other sensitive 
information, however, can be exchanged when necessary. 

Fig . 3 shows a method for carrying out biometric 
identity check by means of a system according to Fig. l 
which comprises a smart card 1, in whose memory a tem- 
plate with a private and a public part iB stored, as well 
as processing unit 2 . 

A person whose identity is to be checked first 
places his smart card 1 in a card reader which is inte- 
grated with or connected to the processing unit 2. He 
then places his finger on the sensor 8 and a digital 
image in grey scale is recorded in step 30 in the same 
way as described above. The image, which is a digital 
representation of the person's fingerprint, can be refer- 
red to as a biometric sample or a fingerprint sample. The 
quality of the image is checked preferably in the same 
way as in the recording of the template ^r»d i s binarised. 
Subsequently the processing unit 2 reads the public part 
of the template on the smart card 1 via the coasHunication 
circuits 3, 4. 

In step 31, the public partial area included in 
the public part of the template is matched or compared 
with, the binarised biometric sample. The matching can 
also be carried out with the entire sample or prefer- 
ably with a part of a predetermined- size, for instance 
100 x 100 pixels, in the centre of the sample. In the 
matching, the public partial area n sweeps" over the sample 
image and in every position a comparison is carried out 
pixel by pixel. If a pixel in the template corresponds 
with a pixel in the sample image, a given value, for exam- 
ple 1, is added to a sum. If the pixels do not correspond, 
the sum is not increased. When the public partial area of 
the template has been swept over the entire sample image,, 
a position is obtained where the public partial area of 
the template best overlaps the sample image. The public 
partial area can also be rotated in relation to the 
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sample image to find out whether a better matching can 
be obtained. 

When the translation and the rotation have been made 
and the best matching position for the sample fingerprint 
5 and the public partial area of the template has been 

found, the obtained matching value is compared in step 3 2 
with a predetermined first comparison criterion, which in 
this case is a reference sum. If the matching value is 
smaller than the reference sum, the identity check is con- 

10 sidered to have failed, step 33, but if the matching value 
is equal to or greater than the reference sum, the process 
proceeds in step 34 . 

By the matching of the public partial area of the 
template with the sample image, it has now been estab- 

15" lished how the template and the sample image are oriented^ 
in relation to each other. Thus, the point in the sample 
image which corresponds to the reference point in the 
template can be established. Then the coordinates in the . 
public part of the template are used to determine which 

20 parts of sample image are to be sent to the smart card 

to be compared with, the private partial areas. More speci- 
fically, in step 34 a partial area of a predetermined size 
is selected round each point which is defined by the coor- 
dinates in the public part of the template. However, the 

25 sample partial areas should be slightly greater than the 
corresponding private partial areas in the template to 
compensate for any deformation of the fingerprint if the 
user's finger has been applied with a different pressure 
on the sensor when recording the sample image . These 

3 0 sample partial areas are then transferred to the smart 
card. 

The areas can be transmitted in a predetermined 
sequence so that the processor on the smart card knows 
which area is which. As a further alternative, coordi- 
3 5 nates for the positioning of the sample partial areas 
can be transmitted as well. 
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In step 35, the processor 5 on the smart card 1 com- 
pares the transmitted sample partial areas with the pri- 
vate partial areas in the private part of the template. 
This matching is much less time-consuming than if the 
5 private partial areas, for example, should be matched with 
the entire sample image since the private partial areas 
need now only be matched in a limited number of positions 
with corresponding sample partial areas. If the position 
of rotation has been established in the processing unit, 

.10 no rotations need be made. For instance, the matching can 
be made in the manner described above where a number of 
points is calculated on the basis of pixel identity. When 
the transferred sample partial areas have been compared 
with the private partial areas of the template, a total 

15 matching value between 0% (i.e. no match at all) and 100% 
(i.e. complete match) is obtained. This matching value is 
compared with a second comparison criterion in the form of 
a predetermined threshold value r step 36, which can be 
stored, in the private part of the template. If the ma ten - 

20 ing value is equal to or greater than the threshold value, 
the identity c heck is considered successful, step 37, and 
the user gains access to the sensitive information stor- 
ed on the card. If the matching value is lower t h*n the 
threshold value, the identity check is considered to have 

25 failed, step 33, and the user is refused access to the 

sensitive information. Alternatively, first the matching 
value of each individual partial area can be compared with 
a threshold value and the number of matching partial areas 
can be determined. 

3 0 A more comprehensive description of how partial areas 

in a fingerprint can be selected and how a template area 
can be compared with a biometric sample area is to be 
found in Applicant' s International Patent Application No. 
PCT/SE99/00553. 

35 Although a special embodiment of the invention has 

been described above, it is obvious to those skilled in 
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the art that many alternatives, modifications and varia- 
tions are feasible in the light of the above description. 

For example, it is possible to use more than one par- 
tial area in the public part of the template. The advan- 
5 tage of this is that a safer initial identity check and 
a safer determination of how the template is oriented 
in relation to the sample image are achieved. A further 
advantage is that if a user has injured his finger so that 
the first partial area does not match, a second public 

10 partial area can possibly match. Moreover the possibi- 
lities of orienting a template in relation to a sample 
image increase if sample image is displaced in relation 
to the template. 

In the example above, the public part of the template 

15 comprises a partial area of the reference fingerprint 
image which is recorded when the template is produced. 
An alternative can be to let the public part comprise a 
description of the mutual positioning and, possibly, the 
kind of a plurality of features of a predetermined type. 

20 These features are transferred in the same way as the 
public partial area and patched with features in the 
sample image to establish the orientation of the tem plate 
In relation to the sample image and, b a s ed on this orien- 
tation, a reference point which may consist of a prede- 

25 tennined of said features and on the basis of which the 
sample partial areas to be transferred to the smart card 
can be determined. 

The public part of the template may also comprise 
other information which makes it possible to determine 

3 0 a reference point in the sample image, for instance a 
specification of a reference point on the basis of a 
relationship between line transitions or the like. 

It would also be possible to let the public part 
of the template contain merely information, for instance 

35 coordinates, which indicates the positioning of the pri- 
vate partial areas in relation to a reference point and 
to let the reference point be a predetermined point in 
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the actual fingerprint, i.e. not in the image, which point 
can be identified in a safe manner. PCT/SE99/00553 dis- 
closes different methods of searching out a reference, 
point in a fingerprint. 
5 In the example above, it is described that the pri- 

vate partial areas are selected according to certain qua- 
lity criteria. It is, of course, possible to select these 
areas according to other criteria. It may be a variant to 
always select the areas in a predetermined position in 

10 relation to the reference point. In such a case, the pub- 
lic part of the template need not contain coordinates for 
the positioning of the private areas. 

In the example above, the template is stored in a 
portable data carrier. It could also be advantageous to 

15 use the described method in communication between a pro- 
cessing unit and a stationary data carrier, such as a 
stationary computer. Such an example could be the use of 
biometric information to verify a user's identity when he 
wants to connect to, for instance, a bank: on the Internet . 

20 The biometric template can thpTt be stored in a stationary 
da tar carrier at the bank, while the user has a fingerprint 
sensor and software to carry out that part of the -above 
method that is carried out in the processing unit. The 
advantage of using the method in this application, where 

25 the calculating capacity of the bank does not need "to con- 
stitute a problem, would be that a significantly smaller 
amount of information need be transmitted from the user 
to the bank in the verification of the user's identity. 

For instance, the areas of the image that are select - 

3 0 ed for the matching can be selected based on criteria com- 
pletely different from those described above. Completely 
different types of biometric data can also be used> such 
as the user's voice and a digital representation thereof 
in the form of a frequency spectrum, or the user's iris. 

35 Therefore the invention is considered to comprise all such 
alternatives, modifications and variations that are within 
the scope of the appended claims. 
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Finally, it should be pointed out that the above 
described comparison of a public partial area with the 
biometric sample can be carried out in many other ways 
than the calculation of number of pointB as described 
5 above. For example, it is possible to use multiplication 
of pixels matching each other and subsequent integration 
in order to obtain a correlation or logic XOR (exclusive 
Or) for corresponding pixels and subsequent summing up. 
The matching can also be made on non-binarised images . 



10 
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1. A portable data carrier, comprising a memory 

5 with a biometric template which is intended to be com- 
pared with a biometric sample for identity check, 
characterised in that the biometric template 
is divided into a private part which is adapted to be. 
exclusively used in the portable data carrier and a 
10 public part which is adapted to be transferred to and 
used in an external processing unit. 

2. A portable data carrier as claimed in claim 1, 
wherein the private part of the biometric template com- 
prises at least one partial area, which constitutes a 

15 private partial area, ©f a digital linage of an indivi- 
dual-specific parameter - 

3- A portable data carrier as claimed in claim 2, 
Kberein the individual -specific parameter is a finger- 
print. 

20 4. A portable data carrier as claimed in claim 2 

or 3 , wherein the public part of the biometric template 
eotspxises information whieh. is intended, to be used for 
determining a reference point in the biometric sainple, 
which reference point corresponds to a reference point 

25 in the biometric template, 

5- A portable data carrier as claimed in claim 2, 3 
or 4, wherein the public part of the biometric template 
comprises information which is intended to be used for 
determining how the template is oriented in relation to 

3 0 the biometric sample. 

6 . A portable data carrier as claimed in any one 
of the preceding claims, wherein the public part of the 
biometric template comprises at least one partial area, 
which constitutes a public partial area, of the digital 

35 image of the individual -specific parameter. 
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7. A portable data carrier as claimed in claim 6, 
wherein the number of private partial areas is greater 
than the number of public partial areas. 

8 . A portable data carrier as claimed in claim 6 or 
7, wherein at least one private partial area is located 
in immediate connection with a public partial area in the 
digital representation. 

9. A portable data carrier as claimed in claim 4 or 
5, wherein the public part of the biometric template com- 
prises information about the mutual positioning of a plu- 
rality of features of a predetermined type in the digital 
image of the individual -specific parameter. 

10 . A portable data carrier as claimed in any one of 
claims 4-9, wherein the public part of the biometric tem- 
plate further comprises information about how said at 
least one private partial area is located in relation to 
said reference point. 

11. A portable data carrier as claimed in any one 
of claims 2-10 , wherein the private part of the template 
comprises at least one threshold value which indicates 
to what extent said at least one private partial area is 
to match a co r x. esponding part ial area of the. biometric 
sample for these two partial areas- ta be considered to 
originate from the -tt&e individual. 

12 . A portable data carrier as claimed in any one of 
the preceding claims, furthear comprising a. communication 
means, via which the public part of the biometric tem- 
plate is adapted to be transferred to the external pro- 
cessing unit. 

13 . A portable data carrier as claimed in any one of 
the preceding claims, further comprising a signal pro- 
cessing means which is adapted to carry out a comparison 
between the private part of the template and at least 
part of the biometric sample. 

14 . A portable data carrier as claimed in any one of 
the preceding claims, wherein the portable data carrier 
is a smart card. 
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15. A method for biometric identity check in a pro- 
cessing unit, characterised by the steps of 

receiving a biometric sample and a public part of 
a biometric template, which has a private part that is 
5 stored in a second unit and that is adapted to be exclu- 
sively used in the second unit; 

comparing the received public part of the template 
with the biometric sample; and 

transferring, when a comparison criterion has been 
10 satisfied, at least part of the biometric sample to the 
second unit for further comparison with the private part 
of the biometric template. 

16. A method as claimed in claim 15, wherein said at 
least part of the biometric sample comprises at least one 

15 partial area in a digital image of an individual -specific 
paramet er . 

17. A method as claimed in claim 15, wherein the 
public part of the biometric template comprises at least 
one partial area in -a digital image of an individual -spe- 

20 cific parameter", 

18. A- method as claimed in claim 15. wherein the 
private part of the ^ometric template comprises a least 
one partial area in a digital image of an individual -spe- 
cific parameter. 

25 19. A method as claimed in claim 15, wherein the 

public part of the biometric template comprises infor- 
mation about the mutual positioning of a plurality of 
features of a predetermined type in the digital image 
of the individual -specific parameter. 

30 20. A method as claimed in any one of claims 15-19, 

further comprising the step of using the result of the 
comparison in order to determine which at least part of 
the biometric sample is to be transferred to the portable 
data carrier. 

35 21 . A method as claimed in any one of claims 15-20, 

further comprising the step of determining a reference 
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point in the biometric sample by means of the public part 
of the template . 

22. A method as claimed in claim 21, wherein the 
received public part of the biometric template comprises 

5 information about how said at least part of the biometric 
sample that is transmitted to the second unit is to be 
located in relation to the reference point, and further 
comprising the step of using this information to deter- 
mine which at least part of the biometric sample is to 
10 be transferred to the portable data carrier. 

23. A method as claimed in any one of claims 15-22, 
wherein the biometric sample is a fingerprint. 

24 . A computer program product comprising program 
code which , during execution in a computer, carries out 

15 a metho d according to claims 15-22. 

25. A processing unit for use in biometric identity 
check, characterised in that it comprises 
means for carrying oat a method according to claims 
15-22. 

2<f 26. A processing unit as claimed in claim 25, where- 

in said fn^anfi comprise a processor and a coraamication 
-means. 

27. A processing unit as claimed in .claim 25 or 26, 
fm t. her comprising a sensor for recording the biometric 

25 sample. 

28. A method for producing a biometric template, 
comprising the steps of 

recording a biometric sample; 

selecting a first part in the biometric sample; 
3 0 selecting a second part in the biometric sample ; 

storing the selected first and second part in a 
memory in a first unit in a public and a private part, 
respectively, of a biometric template, the private part 
being adapted to be exclusively used in the first unit 
3 5 and in the public part being adapted to be used outside 
the first unit. 
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29. A method as claimed in claim 28, wherein the 
step of selecting a first part comprises selecting at 
least one partial area, which constitutes a public par- 
tial area, in a digital image of the individual -specific 

5 parameter. 

30. A method as claimed in claim 28 or 29, wherein 
the step of selecting a second part comprises selecting 
at least one partial area, which constitutes a private 
partial area, in a digital image of the individual- spec i- 

10 fic parameter. 

31. A method as claimed in claim 28 or 29, wherein 
the step of selecting a second pari: comprises determining 
the mutual positioning of a plurality of features of a 
predetermined type in the digital image of the indivi- 

XS dual -specific parameter, and storing information about 
this positioning in the public part of the template. 

32. A mrtbod as claimed in claim 31, further com- 
prisl^sr tbe steps of determining the positioning of the 
private partial area in relation to a reference point 

20 whi c h is defined by a public part of the template, and 
storisc information about the positioning in the public 
pare of tfee template. 

33. A method as claimed in any one of . claims 29-3"2, 
further coaprising the step of storing in the first unit 

25 a threshold value vhich indicates to what extent said at 
least one private partial area is to match a correspond- 
ing partial area of the biometric sample for these two 
partial areas to be considered to originate from the same 
individual . 

30 34 . A method as claimed in any one of the preceding 

claims, wherein the biometric sample is a digital image 
of a fingerprint. 

35. A computer program product comprises program 
code which, during execution in a computer, carries out 

35 the method according to claims 28-34. 

36. A method for carrying out biometric identity 
check, comprising the steps of 
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recording a biometric sample which represents an 
individual -specific parameter; 

comparing in a first unit a public part of a bio- 
metric template, which public part has been received from 
5 a second unit, with the biometric sample in order to find 
out whether a first predetermined comparison criterion 
has been satisfied ; 

selecting, if the first comparison criterion has 
been satisfied, at least part of the biometric sample 
10 according to a predetermined private selection criterion 
and transferring said at least part to the second unit; 

comparing in the second unit said at least part 
of the biometric sample with a private part, stored in 
the second unit, of the biometric template to find out 
15 whether a second predetermined comparison criterion 

37 . A wierft i ' i ri 9B daisied in claim 36 , wherein the 

iicxr^trzc sample is resrerded as a digital image of the 
individual -specific parameter. 
20 38. A Trier hod as claisied in 37, wherein said 

at le'asx parr cf -the biometric sample comprises at -least 
one partial jtrea of the digital image of the. individual - 
specific parameter-. 

39. A method as claimed in claim 37, wherein the 

25 public part of the biometric templates comprises at least 
one partial area of the digital* image of the individual- 
specific parameter. 

40. A method as claimed in claim 37, wherein the 
private part of the biometric template comprises at least 

3 0 one partial area of the digital image of the individual- 
specific parameter. 

■ 41. A computer program product comprising program 
code which, during execution in a computer, carries out 
the method according to claims 36-4 0. 

35 42. Use of a biometric template which is divided 

into a private part adapted to be exclusively used in a 
unit in which the template is stored and a public part 
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adapted to be transferred to and used in an external pro- 
cessing unit. 
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